diff --git a/docs/BUILD b/docs/BUILD
index 6fa677e1..f4f6b55d 100644
--- a/docs/BUILD
+++ b/docs/BUILD
@@ -105,3 +105,10 @@ stardoc(
     input = "//rules:write_file.bzl",
     deps = ["//rules:write_file"],
 )
+
+stardoc(
+    name = "diff_test_docs",
+    out = "diff_test_doc_gen.md",
+    input = "//rules:diff_test.bzl",
+    deps = ["//rules:diff_test"],
+)
diff --git a/rules/BUILD b/rules/BUILD
index 0d7d150b..b008166b 100644
--- a/rules/BUILD
+++ b/rules/BUILD
@@ -22,6 +22,11 @@ bzl_library(
     deps = ["//rules/private:write_file_private"],
 )
 
+bzl_library(
+    name = "diff_test",
+    srcs = ["diff_test.bzl"],
+)
+
 # Exported for build_test.bzl to make sure of, it is an implementation detail
 # of the rule and should not be directly used by anything else.
 exports_files(["empty_test.sh"])
diff --git a/rules/diff_test.bzl b/rules/diff_test.bzl
new file mode 100644
index 00000000..6fb3581f
--- /dev/null
+++ b/rules/diff_test.bzl
@@ -0,0 +1,145 @@
+# Copyright 2019 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""A test rule that compares two binary files.
+
+The rule uses a Bash command (diff) on Linux/macOS/non-Windows, and a cmd.exe
+command (fc.exe) on Windows (no Bash is required).
+"""
+
+def _runfiles_path(f):
+    if f.root.path:
+        return f.path[len(f.root.path) + 1:]  # generated file
+    else:
+        return f.path  # source file
+
+def _diff_test_impl(ctx):
+    if ctx.attr.is_windows:
+        test_bin = ctx.actions.declare_file(ctx.label.name + "-test.bat")
+        ctx.actions.write(
+            output = test_bin,
+            content = r"""@echo off
+SETLOCAL ENABLEEXTENSIONS
+SETLOCAL ENABLEDELAYEDEXPANSION
+set MF=%RUNFILES_MANIFEST_FILE:/=\%
+set PATH=%SYSTEMROOT%\system32
+set F1={file1}
+set F2={file2}
+if "!F1:~0,9!" equ "external/" (set F1=!F1:~9!) else (set F1=!TEST_WORKSPACE!/!F1!)
+if "!F2:~0,9!" equ "external/" (set F2=!F2:~9!) else (set F2=!TEST_WORKSPACE!/!F2!)
+for /F "tokens=2* usebackq" %%i in (`findstr.exe /l /c:"!F1! " "%MF%"`) do (
+  set RF1=%%i
+  set RF1=!RF1:/=\!
+)
+if "!RF1!" equ "" (
+  echo>&2 ERROR: !F1! not found
+  exit /b 1
+)
+for /F "tokens=2* usebackq" %%i in (`findstr.exe /l /c:"!F2! " "%MF%"`) do (
+  set RF2=%%i
+  set RF2=!RF2:/=\!
+)
+if "!RF2!" equ "" (
+  echo>&2 ERROR: !F2! not found
+  exit /b 1
+)
+fc.exe 2>NUL 1>NUL /B "!RF1!" "!RF2!"
+if %ERRORLEVEL% neq 0 (
+  if %ERRORLEVEL% equ 1 (
+    echo>&2 FAIL: files "{file1}" and "{file2}" differ
+    exit /b 1
+  ) else (
+    fc.exe /B "!RF1!" "!RF2!"
+    exit /b %errorlevel%
+  )
+)
+""".format(
+                file1 = _runfiles_path(ctx.file.file1),
+                file2 = _runfiles_path(ctx.file.file2),
+            ),
+            is_executable = True,
+        )
+    else:
+        test_bin = ctx.actions.declare_file(ctx.label.name + "-test.sh")
+        ctx.actions.write(
+            output = test_bin,
+            content = r"""#!/bin/bash
+set -euo pipefail
+F1="{file1}"
+F2="{file2}"
+[[ "$F1" =~ external/* ]] && F1="${{F1#external/}}" || F1="$TEST_WORKSPACE/$F1"
+[[ "$F2" =~ external/* ]] && F2="${{F2#external/}}" || F2="$TEST_WORKSPACE/$F2"
+if [[ -d "${{RUNFILES_DIR:-/dev/null}}" && "${{RUNFILES_MANIFEST_ONLY:-}}" != 1 ]]; then
+  RF1="$RUNFILES_DIR/$F1"
+  RF2="$RUNFILES_DIR/$F2"
+elif [[ -f "${{RUNFILES_MANIFEST_FILE:-/dev/null}}" ]]; then
+  RF1="$(grep -F -m1 "$F1 " "$RUNFILES_MANIFEST_FILE" | sed 's/^[^ ]* //')"
+  RF2="$(grep -F -m1 "$F2 " "$RUNFILES_MANIFEST_FILE" | sed 's/^[^ ]* //')"
+else
+  echo >&2 "ERROR: could not find \"{file1}\" and \"{file2}\""
+  exit 1
+fi
+if ! diff "$RF1" "$RF2"; then
+  echo >&2 "FAIL: files \"{file1}\" and \"{file2}\" differ"
+  exit 1
+fi
+""".format(
+                file1 = _runfiles_path(ctx.file.file1),
+                file2 = _runfiles_path(ctx.file.file2),
+            ),
+            is_executable = True,
+        )
+    return DefaultInfo(
+        executable = test_bin,
+        files = depset(direct = [test_bin]),
+        runfiles = ctx.runfiles(files = [test_bin, ctx.file.file1, ctx.file.file2]),
+    )
+
+_diff_test = rule(
+    attrs = {
+        "file1": attr.label(
+            allow_single_file = True,
+            mandatory = True,
+        ),
+        "file2": attr.label(
+            allow_single_file = True,
+            mandatory = True,
+        ),
+        "is_windows": attr.bool(mandatory = True),
+    },
+    test = True,
+    implementation = _diff_test_impl,
+)
+
+def diff_test(name, file1, file2, **kwargs):
+    """A test that compares two files.
+
+    The test succeeds if the files' contents match.
+
+    Args:
+      name: The name of the test rule.
+      file1: Label of the file to compare to <code>file2</code>.
+      file2: Label of the file to compare to <code>file1</code>.
+      **kwargs: The <a href="https://docs.bazel.build/versions/master/be/common-definitions.html#common-attributes-tests">common attributes for tests</a>.
+    """
+    _diff_test(
+        name = name,
+        file1 = file1,
+        file2 = file2,
+        is_windows = select({
+            "@bazel_tools//src/conditions:host_windows": True,
+            "//conditions:default": False,
+        }),
+        **kwargs
+    )
diff --git a/tests/diff_test/BUILD b/tests/diff_test/BUILD
new file mode 100644
index 00000000..3a33bf28
--- /dev/null
+++ b/tests/diff_test/BUILD
@@ -0,0 +1,42 @@
+# This package aids testing the 'diff_test' rule.
+
+load("//rules:diff_test.bzl", "diff_test")
+
+package(default_testonly = 1)
+
+sh_test(
+    name = "diff_test_tests",
+    srcs = ["diff_test_tests.sh"],
+    data = [
+        "//rules:diff_test",
+        "//tests:unittest.bash",
+    ],
+    deps = ["@bazel_tools//tools/bash/runfiles"],
+)
+
+diff_test(
+    name = "same_src_src",
+    file1 = "a.txt",
+    file2 = "aa.txt",
+)
+
+diff_test(
+    name = "same_src_gen",
+    file1 = "a.txt",
+    file2 = "a-gen.txt",
+)
+
+diff_test(
+    name = "same_gen_gen",
+    file1 = "a-gen.txt",
+    file2 = "aa-gen.txt",
+)
+
+genrule(
+    name = "gen",
+    outs = [
+        "a-gen.txt",
+        "aa-gen.txt",
+    ],
+    cmd = "echo -n 'potato' > $(location a-gen.txt) && echo -n 'potato' > $(location aa-gen.txt)",
+)
diff --git a/tests/diff_test/a.txt b/tests/diff_test/a.txt
new file mode 100644
index 00000000..86ba0095
--- /dev/null
+++ b/tests/diff_test/a.txt
@@ -0,0 +1 @@
+potato
\ No newline at end of file
diff --git a/tests/diff_test/aa.txt b/tests/diff_test/aa.txt
new file mode 100644
index 00000000..86ba0095
--- /dev/null
+++ b/tests/diff_test/aa.txt
@@ -0,0 +1 @@
+potato
\ No newline at end of file
diff --git a/tests/diff_test/b.txt b/tests/diff_test/b.txt
new file mode 100644
index 00000000..19102815
--- /dev/null
+++ b/tests/diff_test/b.txt
@@ -0,0 +1 @@
+foo
\ No newline at end of file
diff --git a/tests/diff_test/diff_test_tests.sh b/tests/diff_test/diff_test_tests.sh
new file mode 100755
index 00000000..aa43307f
--- /dev/null
+++ b/tests/diff_test/diff_test_tests.sh
@@ -0,0 +1,205 @@
+# Copyright 2019 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# --- begin runfiles.bash initialization ---
+# Copy-pasted from Bazel's Bash runfiles library (tools/bash/runfiles/runfiles.bash).
+set -euo pipefail
+if [[ ! -d "${RUNFILES_DIR:-/dev/null}" && ! -f "${RUNFILES_MANIFEST_FILE:-/dev/null}" ]]; then
+  if [[ -f "$0.runfiles_manifest" ]]; then
+    export RUNFILES_MANIFEST_FILE="$0.runfiles_manifest"
+  elif [[ -f "$0.runfiles/MANIFEST" ]]; then
+    export RUNFILES_MANIFEST_FILE="$0.runfiles/MANIFEST"
+  elif [[ -f "$0.runfiles/bazel_tools/tools/bash/runfiles/runfiles.bash" ]]; then
+    export RUNFILES_DIR="$0.runfiles"
+  fi
+fi
+if [[ -f "${RUNFILES_DIR:-/dev/null}/bazel_tools/tools/bash/runfiles/runfiles.bash" ]]; then
+  source "${RUNFILES_DIR}/bazel_tools/tools/bash/runfiles/runfiles.bash"
+elif [[ -f "${RUNFILES_MANIFEST_FILE:-/dev/null}" ]]; then
+  source "$(grep -m1 "^bazel_tools/tools/bash/runfiles/runfiles.bash " \
+            "$RUNFILES_MANIFEST_FILE" | cut -d ' ' -f 2-)"
+else
+  echo >&2 "ERROR: cannot find @bazel_tools//tools/bash/runfiles:runfiles.bash"
+  exit 1
+fi
+# --- end runfiles.bash initialization ---
+
+source "$(rlocation bazel_skylib/tests/unittest.bash)" \
+  || { echo "Could not source bazel_skylib/tests/unittest.bash" >&2; exit 1; }
+
+function import_diff_test() {
+  local -r repo="$1"
+  mkdir -p "${repo}/rules"
+  touch "${repo}/WORKSPACE"
+  ln -sf "$(rlocation bazel_skylib/rules/diff_test.bzl)" \
+         "${repo}/rules/diff_test.bzl"
+  echo "exports_files(['diff_test.bzl'])" > "${repo}/rules/BUILD"
+}
+
+function assert_simple_diff_test() {
+  local -r flag="$1"
+  local -r ws="${TEST_TMPDIR}/$2"
+
+  import_diff_test "$ws"
+  touch "$ws/WORKSPACE"
+  cat >"$ws/BUILD" <<'eof'
+load("//rules:diff_test.bzl", "diff_test")
+
+diff_test(
+    name = "same",
+    file1 = "a.txt",
+    file2 = "a.txt",
+)
+
+diff_test(
+    name = "different",
+    file1 = "a.txt",
+    file2 = "b.txt",
+)
+eof
+  echo foo > "$ws/a.txt"
+  echo bar > "$ws/b.txt"
+
+  (cd "$ws" && \
+   bazel test "$flag" //:same --test_output=errors 1>"$TEST_log" 2>&1 \
+     || fail "expected success")
+
+  (cd "$ws" && \
+   bazel test "$flag" //:different --test_output=errors 1>"$TEST_log" 2>&1 \
+     && fail "expected failure" || true)
+  expect_log 'FAIL: files "a.txt" and "b.txt" differ'
+}
+
+function assert_from_ext_repo() {
+  local -r flag="$1"
+  local -r ws="${TEST_TMPDIR}/$2"
+
+  # Import the rule to an external repository.
+  import_diff_test "$ws/bzl"
+  mkdir -p "$ws/ext1/foo" "$ws/main/ext1/foo" "$ws/ext2/foo" "$ws/main/ext2/foo"
+  cat >"$ws/main/WORKSPACE" <<'eof'
+local_repository(
+    name = "bzl",
+    path = "../bzl",
+)
+
+local_repository(
+    name = "ext1",
+    path = "../ext1",
+)
+
+local_repository(
+    name = "ext2",
+    path = "../ext2",
+)
+eof
+
+  # @ext1 has source files
+  touch "$ws/ext1/WORKSPACE"
+  echo 'exports_files(["foo.txt"])' >"$ws/ext1/foo/BUILD"
+  echo 'foo' > "$ws/ext1/foo/foo.txt"
+
+  # @//ext1/foo has different files than @ext1//foo
+  echo 'exports_files(["foo.txt"])' >"$ws/main/ext1/foo/BUILD"
+  echo 'not foo' > "$ws/main/ext1/foo/foo.txt"
+
+  # @ext2 has generated files
+  touch "$ws/ext2/WORKSPACE"
+  cat >"$ws/ext2/foo/BUILD" <<'eof'
+genrule(
+    name = "gen",
+    outs = [
+        "foo.txt",
+        "bar.txt",
+    ],
+    cmd = "echo 'foo' > $(location foo.txt) && echo 'bar' > $(location bar.txt)",
+    visibility = ["//visibility:public"],
+)
+eof
+
+  # @//ext2/foo has different files than @ext2//foo
+  cat >"$ws/main/ext2/foo/BUILD" <<'eof'
+genrule(
+    name = "gen",
+    outs = ["foo.txt"],
+    cmd = "echo 'not foo' > $@",
+    visibility = ["//visibility:public"],
+)
+eof
+
+  cat >"$ws/main/BUILD" <<'eof'
+load("@bzl//rules:diff_test.bzl", "diff_test")
+
+diff_test(
+    name = "same",
+    file1 = "@ext1//foo:foo.txt",
+    file2 = "@ext2//foo:foo.txt",
+)
+
+diff_test(
+    name = "different1",
+    file1 = "@ext1//foo:foo.txt",
+    file2 = "@ext2//foo:bar.txt",
+)
+
+diff_test(
+    name = "different2",
+    file1 = "@ext1//foo:foo.txt",
+    file2 = "//ext1/foo:foo.txt",
+)
+
+diff_test(
+    name = "different3",
+    file1 = "//ext2/foo:foo.txt",
+    file2 = "@ext2//foo:foo.txt",
+)
+eof
+
+  (cd "$ws/main" && \
+   bazel test "$flag" //:same --test_output=errors 1>"$TEST_log" 2>&1 \
+     || fail "expected success")
+
+  (cd "$ws/main" && \
+   bazel test "$flag" //:different1 --test_output=errors 1>"$TEST_log" 2>&1 \
+     && fail "expected failure" || true)
+  expect_log 'FAIL: files "external/ext1/foo/foo.txt" and "external/ext2/foo/bar.txt" differ'
+
+  (cd "$ws/main" && \
+   bazel test "$flag" //:different2 --test_output=errors 1>"$TEST_log" 2>&1 \
+     && fail "expected failure" || true)
+  expect_log 'FAIL: files "external/ext1/foo/foo.txt" and "ext1/foo/foo.txt" differ'
+
+  (cd "$ws/main" && \
+   bazel test "$flag" //:different3 --test_output=errors 1>"$TEST_log" 2>&1 \
+     && fail "expected failure" || true)
+  expect_log 'FAIL: files "ext2/foo/foo.txt" and "external/ext2/foo/foo.txt" differ'
+}
+
+function test_simple_diff_test_with_legacy_external_runfiles() {
+  assert_simple_diff_test "--legacy_external_runfiles" "${FUNCNAME[0]}"
+}
+
+function test_simple_diff_test_without_legacy_external_runfiles() {
+  assert_simple_diff_test "--nolegacy_external_runfiles" "${FUNCNAME[0]}"
+}
+
+function test_from_ext_repo_with_legacy_external_runfiles() {
+  assert_from_ext_repo "--legacy_external_runfiles" "${FUNCNAME[0]}"
+}
+
+function test_from_ext_repo_without_legacy_external_runfiles() {
+  assert_from_ext_repo "--nolegacy_external_runfiles" "${FUNCNAME[0]}"
+}
+
+run_suite "diff_test_tests test suite"